Improved signature based intrusion detection using clustering rule for decision tree

Authors:
Phuong Do;Ho-Seok Kang;Sung-Ryul Kim
Affiliations:
Konkuk University Seoul, Korea;Konkuk University Seoul, Korea;Konkuk University Seoul, Korea
Venue:
Proceedings of the 2013 Research in Adaptive and Convergent Systems
Year:
2013

Citing 3
Cited 0

Efficient string matching: an aid to bibliographic search

Communications of the ACM
Induction of Decision Trees

Machine Learning
In-Depth Packet Inspection Using a Hierarchical Pattern Matching Algorithm

IEEE Transactions on Dependable and Secure Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Malicious network data are becoming more and more serious nowadays. To deal with this problem, IDSs are used popularly as a security technology that helps to discover, determine and identify unauthorized use of information systems. However, the attacking technologies are becoming more complicated and require more time to detect. In order to make sure that IDS can work efficiently and accurately, novel algorithms need to be applied to adapt to the quick change of attacking technologies. There are many algorithms that are proposed to work on the matching process. Kruegel et al. generated a decision tree that is utilized to find malicious input items using as few redundant comparisons as possible [1]. In this paper, we improve Kruegel's algorithm by changing the clustering strategy for building the decision tree. The experiments show that the quality of the output decision tree could be significantly improved.